CLEANSTART-2026-NH53620 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the loki package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2026-ZA34964 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-HX71601 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the loki package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-ZW28198 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Security vulnerability affects the loki package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation...

CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...

CLEANSTART-2026-PR31494 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the loki package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-KU01035 (*x509

Security vulnerability affects the loki package. x509...

CLEANSTART-2026-DS50998 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-GQ93723 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the loki package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CLEANSTART-2026-HE08866 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the loki package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CLEANSTART-2026-ES62774 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the loki package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-GN20091 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the loki package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-IC69892 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the loki package. etcd is a distributed key-value store for the data of a distributed system...

CLEANSTART-2026-FW47694 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the loki package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-FL18888 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-YT70018 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the loki package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-DZ88780 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the loki package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-OE88191 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the loki package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-RY51837 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the loki package. Previously, a channel registered in the mux's chanList is not usable until it is established...